{"id":"CVE-2026-31738","title":"vxlan: validate ND option lengths in vxlan_na_create","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: validate ND option lengths in vxlan_na_create\n\nvxlan_na_create() walks ND options according to option-provided\nlengths. A malformed option can make the parser ad…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < 901c1dd3bab2955d7e664f914c374c8c3ac2b958","Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < e476745917a1e288eb15e7ff49d286a86a4861d3","Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < 2029712fb2c87e9a8c75094906f2ee29bf08c500","Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < 602596c69a70e50d9ab8c6ae0290a01f88229dd7","Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < de20d2e3b9179d132f5f5b44e490d7c916c6321b","Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < eddfce70a6f3107d1679b0c2fcbeb96b593bd679","Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < b69c4236255bd8de16cd876e58c6f0867d1d78b1","Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < afa9a05e6c4971bd5586f1b304e14d61fb3d9385","Linux d8be18c52dbc94989f6d74637b731af39cd3d902","Linux 3927dace523706cc00f808520eaf2125dd7c07b5","Linux >= 3.12.18 < 3.13","Linux >= 3.13.10 < 3.14","Linux 3.14"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:24:44.664769Z"},"published":"2026-05-01","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:32:23.909Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31738","references":[{"url":"https://git.kernel.org/stable/c/901c1dd3bab2955d7e664f914c374c8c3ac2b958"},{"url":"https://git.kernel.org/stable/c/e476745917a1e288eb15e7ff49d286a86a4861d3"},{"url":"https://git.kernel.org/stable/c/2029712fb2c87e9a8c75094906f2ee29bf08c500"},{"url":"https://git.kernel.org/stable/c/602596c69a70e50d9ab8c6ae0290a01f88229dd7"},{"url":"https://git.kernel.org/stable/c/de20d2e3b9179d132f5f5b44e490d7c916c6321b"},{"url":"https://git.kernel.org/stable/c/eddfce70a6f3107d1679b0c2fcbeb96b593bd679"},{"url":"https://git.kernel.org/stable/c/b69c4236255bd8de16cd876e58c6f0867d1d78b1"},{"url":"https://git.kernel.org/stable/c/afa9a05e6c4971bd5586f1b304e14d61fb3d9385"}],"tags":["cve.org"],"epss":0.00123,"epssPercentile":0.02053,"ingestedAt":"2026-11-06T15:54:04.042Z","slug":"CVE-2026-31738","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: validate ND option lengths in vxlan_na_create\n\nvxlan_na_create() walks ND options according to option-provided\nlengths. A malformed option can make the parser advance beyond the\ncomputed option span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address.\n\n## Affected\n\n- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < 901c1dd3bab2955d7e664f914c374c8c3ac2b958`\n- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < e476745917a1e288eb15e7ff49d286a86a4861d3`\n- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < 2029712fb2c87e9a8c75094906f2ee29bf08c500`\n- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < 602596c69a70e50d9ab8c6ae0290a01f88229dd7`\n- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < de20d2e3b9179d132f5f5b44e490d7c916c6321b`\n- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < eddfce70a6f3107d1679b0c2fcbeb96b593bd679`\n- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < b69c4236255bd8de16cd876e58c6f0867d1d78b1`\n- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < afa9a05e6c4971bd5586f1b304e14d61fb3d9385`\n- `Linux d8be18c52dbc94989f6d74637b731af39cd3d902`\n- `Linux 3927dace523706cc00f808520eaf2125dd7c07b5`\n- `Linux >= 3.12.18 < 3.13`\n- `Linux >= 3.13.10 < 3.14`\n- `Linux 3.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}